Re: MD5-based passwords

Bruce Momjian <pgman(at)candle(dot)pha(dot)pa(dot)us> writes:
>> I believe we should include the new stuff, as it would assist in the 7.2
>> release having more of an "Enterprise" functionality level than
>> without. Might as well have MD5 all round.
>>
>> If bugs are found during our beta testing process, then it might delay
>> the release for a week or two, which is probably worth it.

> I can say pretty reliably that we are long past time in 7.2 where we can
> add code that will push back a final release date. It is fine to slip
> stuff in and take the responsibility for it, but we are in beta now and
> anything that pushes back final is bad, because it pushes back _all_ 7.2
> features from the general user community.

Yup, exactly. "One more feature" is a siren song that you gotta resist,
else we'll never get out of beta.

It might be appropriate to point out that we've already missed the
original target date for 7.2 beta by two months, and that if we can't
produce a release candidate in another week or so we'll likely not have
7.2 final until January. That's a long time to keep the world waiting
for concurrent VACUUM, survival of transaction ID wraparound, and
several other absolutely *critical* improvements in 7.2. If it looks
to me like JDBC MD5 passwords (or any other thing that's not clearly a
bug fix) are going to slip the schedule another week, I'll vote to pass
it over until 7.3.

Once we go beta, we have to focus on wrapping up what we have
and getting it out the door, not on squeezing in stuff that is
"almost ready". There'll always be another release.

regards, tom lane